Detections
Analytics

AlmaLinux 9 : webkit2gtk3 (ALSA-2026:9692)

medium Nessus Plugin ID 310151

Synopsis

The remote AlmaLinux host is missing one or more security updates.

Description

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:9692 advisory.

 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43213)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43214)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2025-43457)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2025-43511)
 * webkitgtk: Processing maliciously crafted web content may disclose internal states of the app (CVE-2025-46299)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20608)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20635)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20636)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20644)
 * webkitgtk: A remote attacker may be able to cause a denial-of-service (CVE-2026-20652)
 * webkitgtk: A website may be able to track users through Safari web extensions (CVE-2026-20676)
 * webkitgtk: Processing maliciously crafted web content may bypass Same Origin Policy (CVE-2026-20643)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-20664)
 * webkitgtk: Processing maliciously crafted web content may prevent Content Security Policy from being enforced (CVE-2026-20665)
 * webkitgtk: A maliciously crafted webpage may be able to fingerprint the user (CVE-2026-20691)
 * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-28857)
 * webkitgtk: A malicious website may be able to process restricted web content outside the sandbox (CVE-2026-28859)
 * webkitgtk: Visiting a maliciously crafted website may lead to a cross-site scripting attack (CVE-2026-28871)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://errata.almalinux.org/9/ALSA-2026-9692.html

https://access.redhat.com/errata/RHSA-2026:9692

Plugin Details

Severity: Medium

ID: 310151

File Name: alma_linux_ALSA-2026-9692.nasl

Version: 1.1

Type: Local

Published: 4/24/2026

Updated: 4/24/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.0

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-20676

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:alma:linux:9::highavailability, cpe:/o:alma:linux:9::resilientstorage, cpe:/o:alma:linux:9::appstream, cpe:/o:alma:linux:9::realtime, cpe:/o:alma:linux:9, cpe:/o:alma:linux:9::sap_hana, cpe:/o:alma:linux:9::supplementary, p-cpe:/a:alma:linux:webkit2gtk3-devel, cpe:/o:alma:linux:9::sap, p-cpe:/a:alma:linux:webkit2gtk3-jsc-devel, cpe:/o:alma:linux:9::crb, cpe:/o:alma:linux:9::nfv, p-cpe:/a:alma:linux:webkit2gtk3-jsc, cpe:/o:alma:linux:9::baseos, p-cpe:/a:alma:linux:webkit2gtk3

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/22/2026

Vulnerability Publication Date: 7/29/2025

Reference Information

CVE: CVE-2025-43213, CVE-2025-43214, CVE-2025-43457, CVE-2025-43511, CVE-2025-46299, CVE-2026-20608, CVE-2026-20635, CVE-2026-20636, CVE-2026-20643, CVE-2026-20644, CVE-2026-20652, CVE-2026-20664, CVE-2026-20665, CVE-2026-20676, CVE-2026-20691, CVE-2026-28857, CVE-2026-28859, CVE-2026-28871

CWE: 120, 201, 346, 416, 497, 693, 79, 909

RHSA: 2026:9692